What makes a password strong?
Length matters most, character variety second. Every extra character multiplies the number of guesses an attacker needs. Strength is measured in bits, and each bit doubles the work.
| Length | a–z and 0–9 | A–Z, a–z, 0–9 | All four types |
|---|---|---|---|
| 8 characters | 41 bits | 48 bits | 51 bits |
| 12 characters | 62 bits | 71 bits | 77 bits |
| 16 characters | 83 bits | 95 bits | 103 bits |
| 20 characters | 103 bits | 119 bits | 129 bits |
A 20-character password of lowercase letters and digits is as strong as a 16-character one with every character type. Current NIST guidance likewise favors long passwords over complicated composition rules.
Everyday password tips
- Use a different password for every account. If one site is breached, the others stay safe.
- Use a password manager to store random passwords. You only need to remember one strong master password.
- Turn on two-factor authentication, especially for email, banking and social media.
- Exclude look-alike characters when you have to type or read a password aloud, such as a Wi-Fi key.
- Don’t send passwords by chat or plain email. If you must, change it after the first login.
How these passwords are made
The generator uses your browser’s crypto.getRandomValues, a cryptographically secure random number generator. Every selected character type appears at least once, then the order is shuffled. Passwords are created only on your device: nothing is sent, logged or stored.
Frequently asked questions
How long should a password be?
At least 12 characters with all types, ideally 16 or more. For a password manager’s master password, 20+ characters is worth it.
Is an online password generator safe?
This one is, because passwords are generated in your browser and never transmitted. You can check: the page keeps working if you go offline after it loads.
Which symbols are used?
! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ? / – Some sites don’t accept all of them. If so, untick symbols and increase the length instead.
How often should I change my passwords?
Not on a fixed schedule, but right away if a service was breached or you suspect a problem. Strong, unique passwords matter more than frequent changes.